Cyber security audit
Cyber security audit services in Canada
An independent review of your controls against NIST, CIS, ISO 27001, SOC 2, PCI DSS or PHIPA, with a scored gap report and a roadmap you can act on.
Stop guessing. A cyber security audit from Canada Create™ tells you what you have, what you are missing and what to fix first, in a document your board, your insurer and your customers can read.
Get your cyber security audit proposal
Tell us your size, systems and the framework you need. Fixed price in writing within one business day.
By submitting, you agree that Canada Create™ may contact you about your request. No spam, ever.
What a cyber security audit gives you
A scored picture of your security
Every control area rated with evidence, not opinion.
A prioritized roadmap
Quick wins, quarter projects and year programs, ranked by risk and effort.
Evidence for insurers and customers
An executive summary that answers questionnaires and procurement reviews.
Spend that goes to the right place
Tools and services bought for the gaps you actually have.
What the cyber security audit covers
Eight control areas, mapped to the framework that suits your organization.
- Identity and accessMFA coverage, privileged accounts, shared passwords and offboarding.
- Endpoints and devicesPatching, encryption, endpoint protection and device management.
- Email and collaborationMicrosoft 365 and Google Workspace settings, DMARC, sharing and forwarding rules.
- Network and cloudFirewalls, remote access, segmentation, cloud configuration and logging.
- Web applications and websitesPublic site, portals, e-commerce, plugins, integrations and hosting.
- Data, backups and recoveryWhere sensitive data lives, how it is backed up and how fast it comes back.
- Vendors and third partiesWho has access to your systems and what you have in writing.
- Policies, training and incident readinessWhether policies exist, are followed and are ready for the day it matters.
Cyber security audit pricing
Scope decides price: size, locations, systems and the framework you need.
Small business audit
Quoted in writing
Companies with 5 to 100 staff, typically cloud-first on Microsoft 365 or Google Workspace
- All eight control areas
- CIS Controls or NIST CSF mapping
- Scored report and roadmap
- Executive summary for insurers and customers
Regulated or multi-site audit
By proposal
Healthcare, legal, finance, public sector, SaaS and organizations with on-premises or custom systems
- Everything in the small business audit
- ISO 27001, SOC 2, PCI DSS, PHIPA or PIPEDA mapping
- Vendor and third-party review
- Optional penetration test and risk assessment in one engagement
Audit fees are credited toward a managed security program started within 90 days.
Independent review
Know exactly where you stand
A cyber security audit that tells you where you stand, in writing
Before you spend on tools, testing or monitoring, you need one honest document: what controls you have, what you are missing, and what to fix first. A Canada Create™ cyber security audit reviews your organization against a recognized framework, scores every control, and delivers a prioritized roadmap that your leadership, your insurer and your customers can read. It is usually the first thing an enterprise buyer, a regulator or a cyber insurance underwriter asks for, and it is the fastest way to stop guessing.
What the audit covers
We assess the areas where breaches actually happen, mapped to the framework that suits you: NIST Cybersecurity Framework, CIS Controls, ISO 27001, or the requirements of SOC 2, PCI DSS, PHIPA or PIPEDA where those apply.
Identity and access
Who can reach what, multi-factor authentication coverage, privileged accounts, shared passwords, offboarding gaps and the service accounts everyone forgot.
Endpoints and devices
Patching, encryption, endpoint protection, mobile device management and the personal devices that touch company data.
Email and collaboration
Microsoft 365 and Google Workspace configuration, DMARC, SPF and DKIM, sharing policies, external forwarding rules and the settings attackers exploit most.
Network and cloud
Firewalls, remote access, VPN, Wi-Fi, segmentation, cloud tenant configuration, storage exposure and logging.
Web applications and websites
Your public site, customer portals, e-commerce and the plugins, integrations and hosting behind them, informed by 18 years of building and hosting exactly these systems.
Data, backups and recovery
Where sensitive data lives, who can reach it, how it is backed up, whether restores are tested and how long recovery would actually take.
Vendors and third parties
The suppliers, contractors and software providers with access to your systems or data, and what you have in writing from them.
Policies, training and incident readiness
Whether the policies exist, whether people follow them, whether staff can spot a phishing email and whether anyone knows what to do on the day something goes wrong.
What you receive
A scored report by control area with a clear rating for each, evidence of what we found, and a gap list ranked by risk and effort. A remediation roadmap in three horizons: quick wins for the next 30 days, projects for the next quarter, and programs for the year. An executive summary suitable for boards, insurers and customer procurement teams. And a working session with your leadership and IT team to agree on ownership and timing. If you want the findings tested rather than reviewed, the audit pairs naturally with a penetration test.
Who commissions a cyber security audit
Business owners who suspect their IT provider has been saying “it is handled” for too long. Executives facing a customer security questionnaire or an enterprise procurement review. Clinics, law firms, accounting and wealth management firms with regulator and professional obligations. SaaS companies preparing for SOC 2. Organizations renewing cyber insurance or recovering from an incident. And boards that want an independent view rather than a self-assessment.
Audit versus risk assessment
An audit checks whether controls exist and work. A risk assessment ranks what would hurt the business most if they failed. Regulated organizations usually need both; most businesses start with the audit because it produces the roadmap. We can run them together in one engagement.
Cyber security audit pricing
Audit pricing depends on organization size, number of locations and systems, and the framework you need to map to. A 20-person firm on Microsoft 365 is a different scope from a multi-site organization with on-premises servers and a custom application. Tell us what you run and you will have a fixed price in writing within one business day.
Book your cyber security audit
Get a proposal in one business day, or call +1 (800) 808-9235 any time. Part of our cyber security services for Canadian businesses.
Talk to a strategist
Ready when you are!
Get a proposal in one business day.
Tell us your goals, budget and timeline. You get a plan, a price and a named strategist, with no long-term contract.
How the audit runs
Two to four weeks from kickoff to roadmap, with minimal disruption to your team.
- Kickoff and framework selection Day 1 to 3
Scope, systems, locations and the framework you need to map to.
- Evidence collection Week 1 to 2
Configuration reviews, interviews, document review and technical checks.
- Analysis and scoring Week 2 to 3
Each control area rated with evidence and mapped gaps.
- Report and roadmap Week 3 to 4
Scored report, ranked gap list, three-horizon roadmap and executive summary.
- Leadership session Week 4
Working session to agree on ownership, timing and budget.
What clients say on Google
Reviews pulled live from our Google Business Profile.
Free review, no obligation
Not sure where to start? Send us what you have.
Share your current site, campaign or brief. A strategist reviews it and replies within one business day with a written recommendation and a fixed quote.
Why Canada Create™ for your security audit
Practitioners, not checklists
We have built and hosted business systems since 2008 and know where the real gaps hide.
BBB Accredited, A+
An A+ rating with the Better Business Bureau and zero complaints.
Framework-mapped
NIST, CIS, ISO 27001, SOC 2, PCI DSS, PHIPA and PIPEDA.
Quoted in writing
Fixed price before work starts. Get a proposal in one business day.
A roadmap we can execute
Testing, managed security, hosting and development under one roof.
24/7* support
Call +1 (800) 808-9235 any time, day or night.
Cyber security audit questions
What is a cyber security audit?
An independent review of your security controls against a recognized framework, producing a scored report of what you have, what you are missing and what to fix first.
What is the difference between an audit and a penetration test?
An audit reviews whether controls exist and are configured properly. A penetration test tries to break through them. Many organizations do both, and we can run them in one engagement.
How much does a cyber security audit cost in Canada?
It depends on size, locations, systems and the framework you need. Every audit is quoted at a fixed price in writing within one business day.
How long does the audit take?
Two to four weeks for most organizations, with a few hours of your team time for interviews and access.
Which frameworks do you audit against?
NIST Cybersecurity Framework, CIS Controls, ISO 27001, SOC 2, PCI DSS, PHIPA and PIPEDA, chosen to match what your regulator, auditor or customer expects.
Will the audit disrupt our business?
No. It is a review of configurations, documents and interviews. Any technical checks are read-only unless you also commission testing.
Is a cyber security audit required for cyber insurance?
Not always, but insurers increasingly ask detailed control questions at renewal. The audit answers them with evidence and often improves your terms.
Do you audit our IT provider's work?
Yes, independently and respectfully. Most providers welcome a clear roadmap, and we coordinate fixes with them afterwards.
What happens after the audit?
You get a roadmap with owners and timing. We can implement it through testing, managed security, hosting and development, or hand it to your team.
Do you audit websites and web applications?
Yes. Your public site, portals and e-commerce are part of every audit, informed by 18 years of building and hosting them.
It is handled is not a security strategy
Most owners find out what was missing after the incident. An audit shows you before.
